feat: add hub-core database lease projections

workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md

@@ -0,0 +1,53 @@
+---
+id: RAILIANCE-WP-0023
+type: workplan
+title: "Hub-core candidate credential lanes"
+domain: financials
+repo: railiance-platform
+status: active
+owner: codex
+topic_slug: railiance
+created: "2026-08-21"
+updated: "2026-08-21"
+related:
+  - CORE-WP-0010
+  - RAPPCOREHUB-WP-0002
+  - RAPP-POSTGRES-WP-0004
+---
+
+# Hub-core candidate credential lanes
+
+## Extend exact-scope policy and projections
+
+```task
+id: RAILIANCE-WP-0023-T01
+status: done
+priority: high
+```
+
+Add only `database/creds/hub-core-runtime` and
+`database/creds/hub-core-migration` to the existing namespace-limited Core Hub
+database store, with separate five-minute ExternalSecret projections.
+
+## Activate and verify production lanes
+
+```task
+id: RAILIANCE-WP-0023-T02
+status: progress
+priority: high
+```
+
+Apply the reviewed policy and projections after rapp-postgres creates the
+roles. Verify store validity, SecretSynced status, role separation, and lease
+rotation without reading or logging values.
+
+## Hand off the private candidate
+
+```task
+id: RAILIANCE-WP-0023-T03
+status: wait
+priority: high
+```
+
+Confirm both Secret metadata objects are ready, then hand the candidate
+migration and rollout gate back to `RAPPCOREHUB-WP-0002-T03`.